[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[XEN PATCH v3] xen: rework `checkpolicy` detection when using "randconfig"

  • To: <xen-devel@xxxxxxxxxxxxxxxxxxxx>
  • From: Anthony PERARD <anthony.perard@xxxxxxxxxx>
  • Date: Wed, 8 Sep 2021 12:17:27 +0100
  • Authentication-results: esa4.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none
  • Cc: Anthony PERARD <anthony.perard@xxxxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, George Dunlap <george.dunlap@xxxxxxxxxx>, "Ian Jackson" <iwj@xxxxxxxxxxxxxx>, Jan Beulich <jbeulich@xxxxxxxx>, Julien Grall <julien@xxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>, Wei Liu <wl@xxxxxxx>
  • Delivery-date: Wed, 08 Sep 2021 11:17:50 +0000
  • Ironport-hdrordr: A9a23:Z2m7M6wW8HYwdS+Q8kRnKrPwIL1zdoMgy1knxilNoRw8SKKlfq eV7ZAmPH7P+VAssR4b+exoVJPtfZq+z+8R3WByB8bAYOCOggLBR+sO0WKL+UyGJ8SUzI9gPM lbHJSWcOeAb2RHsQ==
  • Ironport-sdr: eJup9ZqHw10h4D/ZS5pZyXcOzlKqTsplKgaSzOy3lgSUgNnC0xL2D1DEtmDOsi+MyZy5D3z7iu EJo4Te53bMEeEYuZE1XZOyXMdxozW+HGQS+ymxbmOHjjgcFC+hVXiIVFpeL+GpuuTW9fjU8IID cvjRSX5Kb00xT3kDIiH8rYtZMCNKl1axeZiAeW/Yu2Beqz06s/IFEZ3ijsVxvMUU62aNOfmUxC rvKgSOaPvFGeg14yGV0msqMqFRPFkdfvew6uj6C7/lvOdsnu3q9ZozPPKTElLAWZLneRp/i3p3 xCY2pPOryyrlwzmj5kVEnd6T
  • List-id: Xen developer discussion <xen-devel.lists.xenproject.org>

This will help prevent the CI loop from having build failures when
`checkpolicy` isn't available when doing "randconfig" jobs.

To prevent "randconfig" from selecting XSM_FLASK_POLICY when
`checkpolicy` isn't available, we will actually override the config
output with the use of KCONFIG_ALLCONFIG.

Doing this way still allow a user/developer to set XSM_FLASK_POLICY
even when "checkpolicy" isn't available. It also prevent the build
system from reset the config when "checkpolicy" isn't available
anymore. And XSM_FLASK_POLICY is still selected automatically when
`checkpolicy` is available.
But this also work well for "randconfig", as it will not select
XSM_FLASK_POLICY when "checkpolicy" is missing.

This patch allows to easily add more override which depends on the

Also, move the check out of Config.mk and into xen/ build system.
Nothing in tools/ is using that information as it's done by

Signed-off-by: Anthony PERARD <anthony.perard@xxxxxxxxxx>
- don't override XSM_FLASK_POLICY value unless we do randconfig.
- no more changes to the current behavior of kconfig, only to

v2 was "[XEN PATCH v2] xen: allow XSM_FLASK_POLICY only if checkpolicy binary 
is available"
 Config.mk          |  6 ------
 xen/Makefile       | 18 ++++++++++++++++--
 xen/common/Kconfig |  2 +-
 3 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/Config.mk b/Config.mk
index d0712724f8e4..144411133f38 100644
--- a/Config.mk
+++ b/Config.mk
@@ -137,12 +137,6 @@ export XEN_HAS_BUILD_ID=y
 build_id_linker := --build-id=sha1
-    CHECKPOLICY ?= checkpolicy
-    XEN_HAS_CHECKPOLICY := $(shell $(CHECKPOLICY) -h 2>&1 | grep -q xen && 
echo y || echo n)
 define buildmakevars2shellvars
     export PREFIX="$(prefix)";                                            \
     export XEN_SCRIPT_DIR="$(XEN_SCRIPT_DIR)";                            \
diff --git a/xen/Makefile b/xen/Makefile
index f47423dacd9a..89804aefe385 100644
--- a/xen/Makefile
+++ b/xen/Makefile
@@ -17,6 +17,8 @@ export XEN_BUILD_HOST ?= $(shell hostname)
 PYTHON_INTERPRETER     := $(word 1,$(shell which python3 python python2 
2>/dev/null) python)
 export PYTHON          ?= $(PYTHON_INTERPRETER)
+export CHECKPOLICY     ?= checkpolicy
 export BASEDIR := $(CURDIR)
 export XEN_ROOT := $(BASEDIR)/..
@@ -178,6 +180,8 @@ CFLAGS += $(CLANG_FLAGS)
+export HAS_CHECKPOLICY := $(call success,$(CHECKPOLICY) -h 2>&1 | grep -q xen)
 export root-make-done := y
 endif # root-make-done
@@ -189,14 +193,24 @@ ifeq ($(config-build),y)
 # *config targets only - make sure prerequisites are updated, and descend
 # in tools/kconfig to make the *config target
+# Create a file for KCONFIG_ALLCONFIG which depends on the environment.
+# This will be use by kconfig targets 
+filechk_kconfig_allconfig = \
+    $(if $(findstring n,$(HAS_CHECKPOLICY)),echo 'CONFIG_XSM_FLASK_POLICY=n';) 
+.allconfig.tmp: FORCE
+       set -e; { $(call filechk_kconfig_allconfig); } > $@
 config: FORCE
        $(MAKE) $(kconfig) $@
 # Config.mk tries to include .config file, don't try to remake it
 %/.config: ;
-%config: FORCE
-       $(MAKE) $(kconfig) $@
+%config: .allconfig.tmp FORCE
+       $(MAKE) $(kconfig) KCONFIG_ALLCONFIG=$< $@
 else # !config-build
diff --git a/xen/common/Kconfig b/xen/common/Kconfig
index 0ddd18e11af3..73d8afb7bcbd 100644
--- a/xen/common/Kconfig
+++ b/xen/common/Kconfig
@@ -235,7 +235,7 @@ config XSM_FLASK_AVC_STATS
        bool "Compile Xen with a built-in FLASK security policy"
-       default y if "$(XEN_HAS_CHECKPOLICY)" = "y"
+       default y if "$(HAS_CHECKPOLICY)"
        depends on XSM_FLASK
          This includes a default XSM policy in the hypervisor so that the
Anthony PERARD



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.